@cregis-dev/cckit 0.3.0 → 0.4.1

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04-evaluate-and-score.md

@@ -1,36 +1,37 @@
 ---
 name: 'step-04-evaluate-and-score'
-description: 'Orchestrate parallel NFR domain assessments (4 subprocesses)'
+description: 'Orchestrate adaptive NFR domain assessments (agent-team, subagent, or sequential)'
 nextStepFile: './step-04e-aggregate-nfr.md'
 ---
 
-# Step 4: Orchestrate Parallel NFR Assessment
+# Step 4: Orchestrate Adaptive NFR Assessment
 
 ## STEP GOAL
 
-Launch 4 parallel subprocesses to assess independent NFR domains simultaneously for maximum performance.
+Select execution mode deterministically, then assess NFR domains using agent-team, subagent, or sequential execution while preserving output contracts.
 
 ## MANDATORY EXECUTION RULES
 
 - 📖 Read the entire step file before acting
 - ✅ Speak in `{communication_language}`
-- ✅ Launch FOUR subprocesses in PARALLEL
-- ✅ Wait for ALL subprocesses to complete
-- ❌ Do NOT assess NFRs sequentially (use subprocesses)
+- ✅ Resolve execution mode from config (`tea_execution_mode`, `tea_capability_probe`)
+- ✅ Apply fallback rules deterministically when requested mode is unsupported
+- ✅ Wait for required worker steps to complete
+- ❌ Do NOT skip capability checks when probing is enabled
 
 ---
 
 ## EXECUTION PROTOCOLS:
 
 - 🎯 Follow the MANDATORY SEQUENCE exactly
-- 💾 Wait for subprocess outputs
+- 💾 Wait for subagent outputs
 - 📖 Load the next step only when instructed
 
 ---
 
 ## MANDATORY SEQUENCE
 
-### 1. Prepare Subprocess Inputs
+### 1. Prepare Execution Context
 
 **Generate unique timestamp:**
 
@@ -41,73 +42,186 @@ const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
 **Prepare context:**
 
 ```javascript
-const subprocessContext = {
+const parseBooleanFlag = (value, defaultValue = true) => {
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (['false', '0', 'off', 'no'].includes(normalized)) return false;
+    if (['true', '1', 'on', 'yes'].includes(normalized)) return true;
+  }
+  if (value === undefined || value === null) return defaultValue;
+  return Boolean(value);
+};
+
+const subagentContext = {
   system_context: /* from Step 1 */,
   nfr_thresholds: /* from Step 2 */,
   evidence_gathered: /* from Step 3 */,
+  config: {
+    execution_mode: config.tea_execution_mode || 'auto',  // "auto" | "subagent" | "agent-team" | "sequential"
+    capability_probe: parseBooleanFlag(config.tea_capability_probe, true),  // supports booleans and "false"/"true" strings
+  },
   timestamp: timestamp
 };
 ```
 
 ---
 
-### 2. Launch 4 Parallel NFR Subprocesses
+### 2. Resolve Execution Mode with Capability Probe
 
-**Subprocess A: Security Assessment**
+```javascript
+const normalizeUserExecutionMode = (mode) => {
+  if (typeof mode !== 'string') return null;
+  const normalized = mode.trim().toLowerCase().replace(/[-_]/g, ' ').replace(/\s+/g, ' ');
+
+  if (normalized === 'auto') return 'auto';
+  if (normalized === 'sequential') return 'sequential';
+  if (normalized === 'subagent' || normalized === 'sub agent' || normalized === 'subagents' || normalized === 'sub agents') {
+    return 'subagent';
+  }
+  if (normalized === 'agent team' || normalized === 'agent teams' || normalized === 'agentteam') {
+    return 'agent-team';
+  }
+
+  return null;
+};
 
-- File: `./step-04a-subprocess-security.md`
+const normalizeConfigExecutionMode = (mode) => {
+  if (mode === 'subagent') return 'subagent';
+  if (mode === 'auto' || mode === 'sequential' || mode === 'subagent' || mode === 'agent-team') {
+    return mode;
+  }
+  return null;
+};
+
+// Explicit user instruction in the active run takes priority over config.
+const explicitModeFromUser = normalizeUserExecutionMode(runtime.getExplicitExecutionModeHint?.() || null);
+
+const requestedMode = explicitModeFromUser || normalizeConfigExecutionMode(subagentContext.config.execution_mode) || 'auto';
+const probeEnabled = subagentContext.config.capability_probe;
+
+const supports = {
+  subagent: false,
+  agentTeam: false,
+};
+
+if (probeEnabled) {
+  supports.subagent = runtime.canLaunchSubagents?.() === true;
+  supports.agentTeam = runtime.canLaunchAgentTeams?.() === true;
+}
+
+let resolvedMode = requestedMode;
+
+if (requestedMode === 'auto') {
+  if (supports.agentTeam) resolvedMode = 'agent-team';
+  else if (supports.subagent) resolvedMode = 'subagent';
+  else resolvedMode = 'sequential';
+} else if (probeEnabled && requestedMode === 'agent-team' && !supports.agentTeam) {
+  resolvedMode = supports.subagent ? 'subagent' : 'sequential';
+} else if (probeEnabled && requestedMode === 'subagent' && !supports.subagent) {
+  resolvedMode = 'sequential';
+}
+
+subagentContext.execution = {
+  requestedMode,
+  resolvedMode,
+  probeEnabled,
+  supports,
+};
+```
+
+Resolution precedence:
+
+1. Explicit user request in this run (`agent team` => `agent-team`; `subagent` => `subagent`; `sequential`; `auto`)
+2. `tea_execution_mode` from config
+3. Runtime capability fallback (when probing enabled)
+
+If probing is disabled, honor the requested mode strictly. If that mode cannot be executed at runtime, fail with explicit error instead of silent fallback.
+
+---
+
+### 3. Dispatch 4 NFR Workers
+
+**Subagent A: Security Assessment**
+
+- File: `./step-04a-subagent-security.md`
 - Output: `/tmp/tea-nfr-security-${timestamp}.json`
+- Execution:
+  - `agent-team` or `subagent`: launch non-blocking
+  - `sequential`: run blocking and wait
 - Status: Running... ⟳
 
-**Subprocess B: Performance Assessment**
+**Subagent B: Performance Assessment**
 
-- File: `./step-04b-subprocess-performance.md`
+- File: `./step-04b-subagent-performance.md`
 - Output: `/tmp/tea-nfr-performance-${timestamp}.json`
 - Status: Running... ⟳
 
-**Subprocess C: Reliability Assessment**
+**Subagent C: Reliability Assessment**
 
-- File: `./step-04c-subprocess-reliability.md`
+- File: `./step-04c-subagent-reliability.md`
 - Output: `/tmp/tea-nfr-reliability-${timestamp}.json`
 - Status: Running... ⟳
 
-**Subprocess D: Scalability Assessment**
+**Subagent D: Scalability Assessment**
 
-- File: `./step-04d-subprocess-scalability.md`
+- File: `./step-04d-subagent-scalability.md`
 - Output: `/tmp/tea-nfr-scalability-${timestamp}.json`
 - Status: Running... ⟳
 
+In `agent-team` and `subagent` modes, runtime decides worker scheduling and concurrency.
+
 ---
 
-### 3. Wait for All Subprocesses
+### 4. Wait for Expected Worker Completion
+
+**If `resolvedMode` is `agent-team` or `subagent`:**
 
 ```
-⏳ Waiting for 4 NFR subprocesses to complete...
-  ├── Subprocess A (Security): Running... ⟳
-  ├── Subprocess B (Performance): Running... ⟳
-  ├── Subprocess C (Reliability): Running... ⟳
-  └── Subprocess D (Scalability): Running... ⟳
+⏳ Waiting for 4 NFR subagents to complete...
+  ├── Subagent A (Security): Running... ⟳
+  ├── Subagent B (Performance): Running... ⟳
+  ├── Subagent C (Reliability): Running... ⟳
+  └── Subagent D (Scalability): Running... ⟳
 
 [... time passes ...]
 
-✅ All 4 NFR subprocesses completed!
+✅ All 4 NFR subagents completed!
+```
+
+**If `resolvedMode` is `sequential`:**
+
+```
+✅ Sequential mode: each worker already completed during dispatch.
+```
+
+---
+
+### 5. Verify All Outputs Exist
+
+```javascript
+const outputs = ['security', 'performance', 'reliability', 'scalability'].map((domain) => `/tmp/tea-nfr-${domain}-${timestamp}.json`);
+
+outputs.forEach((output) => {
+  if (!fs.existsSync(output)) {
+    throw new Error(`Subagent output missing: ${output}`);
+  }
+});
 ```
 
 ---
 
-### 4. Performance Report
+### 6. Execution Report
 
 ```
 🚀 Performance Report:
-- Execution Mode: PARALLEL (4 NFR domains)
-- Total Elapsed: ~max(all subprocesses) minutes
-- Sequential Would Take: ~sum(all subprocesses) minutes
-- Performance Gain: ~67% faster!
+- Execution Mode: {resolvedMode}
+- Total Elapsed: ~mode-dependent
+- Parallel Gain: ~67% faster when mode is subagent/agent-team
 ```
 
 ---
 
-### 5. Proceed to Aggregation
+### 7. Proceed to Aggregation
 
 Load next step: `{nextStepFile}`
 
@@ -123,7 +237,7 @@ The aggregation step will:
 
 ## EXIT CONDITION
 
-Proceed when all 4 subprocesses completed and outputs exist.
+Proceed when all 4 required worker steps completed and outputs exist.
 
 ---
 
@@ -131,10 +245,10 @@ Proceed when all 4 subprocesses completed and outputs exist.
 
 ### ✅ SUCCESS:
 
-- All 4 NFR subprocesses completed
-- Parallel execution achieved ~67% performance gain
+- All required worker steps completed
+- Fallback behavior respected configuration and capability probe rules
 
 ### ❌ FAILURE:
 
-- One or more subprocesses failed
-- Sequential assessment instead of parallel
+- One or more subagents failed
+- Unsupported requested mode with probing disabled

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04a-subagent-security.md

@@ -0,0 +1,138 @@
+---
+name: 'step-04a-subagent-security'
+description: 'Subagent: Security NFR assessment'
+subagent: true
+outputFile: '/tmp/tea-nfr-security-{{timestamp}}.json'
+---
+
+# Subagent 4A: Security NFR Assessment
+
+## SUBAGENT CONTEXT
+
+This is an **isolated subagent** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess SECURITY NFR domain only.
+
+---
+
+## MANDATORY EXECUTION RULES
+
+- ✅ Assess SECURITY only (not performance, reliability, scalability)
+- ✅ Output structured JSON to temp file
+- ❌ Do NOT assess other NFR domains
+
+---
+
+## SUBAGENT TASK
+
+### 1. Security Assessment Categories
+
+**Assess the following security dimensions:**
+
+**A) Authentication & Authorization:**
+
+- OAuth2/JWT implementation
+- Session management
+- Multi-factor authentication
+- Role-based access control (RBAC)
+
+**B) Data Protection:**
+
+- Encryption at rest
+- Encryption in transit (HTTPS/TLS)
+- Sensitive data handling (PII, passwords)
+- Database encryption
+
+**C) Input Validation:**
+
+- SQL injection prevention
+- XSS prevention
+- CSRF protection
+- Input sanitization
+
+**D) API Security:**
+
+- Rate limiting
+- API authentication
+- CORS configuration
+- Security headers
+
+**E) Secrets Management:**
+
+- Environment variables for secrets
+- No hardcoded credentials
+- Secret rotation policies
+- Key management systems
+
+### 2. Risk Assessment
+
+For each category, determine status:
+
+- **PASS**: Properly implemented
+- **CONCERN**: Partially implemented or weak
+- **FAIL**: Not implemented or critical vulnerability
+- **N/A**: Not applicable to this system
+
+### 3. Compliance Check
+
+**Common compliance standards:**
+
+- SOC2
+- GDPR
+- HIPAA
+- PCI-DSS
+- ISO 27001
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "security",
+  "risk_level": "MEDIUM",
+  "findings": [
+    {
+      "category": "Authentication",
+      "status": "PASS",
+      "description": "OAuth2 with JWT tokens implemented",
+      "evidence": ["src/auth/oauth.ts", "JWT refresh token rotation"],
+      "recommendations": []
+    },
+    {
+      "category": "Data Encryption",
+      "status": "CONCERN",
+      "description": "Database encryption at rest not enabled",
+      "evidence": ["Database config shows no encryption"],
+      "recommendations": ["Enable database encryption at rest", "Use AWS RDS encryption or equivalent", "Implement key rotation policy"]
+    },
+    {
+      "category": "Input Validation",
+      "status": "FAIL",
+      "description": "SQL injection vulnerability in search endpoint",
+      "evidence": ["src/api/search.ts:42 - direct SQL concatenation"],
+      "recommendations": ["URGENT: Use parameterized queries", "Add input sanitization library", "Implement WAF rules"]
+    }
+  ],
+  "compliance": {
+    "SOC2": "PARTIAL",
+    "GDPR": "PASS",
+    "HIPAA": "N/A",
+    "PCI-DSS": "FAIL"
+  },
+  "priority_actions": [
+    "Fix SQL injection vulnerability (URGENT)",
+    "Enable database encryption within 30 days",
+    "Implement rate limiting for all APIs"
+  ],
+  "summary": "Security posture is MEDIUM risk with 1 critical vulnerability requiring immediate attention"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subagent completes when JSON output written to temp file.
+
+**Subagent terminates here.**

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04b-subagent-performance.md

@@ -0,0 +1,84 @@
+---
+name: 'step-04b-subagent-performance'
+description: 'Subagent: Performance NFR assessment'
+subagent: true
+outputFile: '/tmp/tea-nfr-performance-{{timestamp}}.json'
+---
+
+# Subagent 4B: Performance NFR Assessment
+
+## SUBAGENT CONTEXT
+
+This is an **isolated subagent** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess PERFORMANCE NFR domain only.
+
+---
+
+## SUBAGENT TASK
+
+### 1. Performance Assessment Categories
+
+**A) Response Times:**
+
+- API response times (<200ms target)
+- Page load times (<2s target)
+- Time to interactive (<3s target)
+
+**B) Throughput:**
+
+- Requests per second capacity
+- Concurrent user support
+- Database query performance
+
+**C) Resource Usage:**
+
+- Memory consumption
+- CPU utilization
+- Database connection pooling
+
+**D) Optimization:**
+
+- Caching strategies
+- CDN usage
+- Code splitting/lazy loading
+- Database indexing
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "performance",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Response Times",
+      "status": "PASS",
+      "description": "API endpoints respond in <150ms (P95)",
+      "evidence": ["Load testing results show 140ms P95"],
+      "recommendations": []
+    },
+    {
+      "category": "Caching",
+      "status": "CONCERN",
+      "description": "No CDN for static assets",
+      "evidence": ["Static files served from origin"],
+      "recommendations": ["Implement CDN (CloudFront/Cloudflare)", "Cache static assets for 1 year"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS",
+    "SLA_99.99": "CONCERN"
+  },
+  "priority_actions": ["Implement CDN for static assets", "Add database query caching for frequent reads"],
+  "summary": "Performance is acceptable with minor optimization opportunities"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subagent completes when JSON output written to temp file.

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04c-subagent-reliability.md

@@ -0,0 +1,85 @@
+---
+name: 'step-04c-subagent-reliability'
+description: 'Subagent: Reliability NFR assessment'
+subagent: true
+outputFile: '/tmp/tea-nfr-reliability-{{timestamp}}.json'
+---
+
+# Subagent 4C: Reliability NFR Assessment
+
+## SUBAGENT CONTEXT
+
+This is an **isolated subagent** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess RELIABILITY NFR domain only.
+
+---
+
+## SUBAGENT TASK
+
+### 1. Reliability Assessment Categories
+
+**A) Error Handling:**
+
+- Try-catch blocks for critical operations
+- Graceful degradation
+- Circuit breakers
+- Retry mechanisms
+
+**B) Monitoring & Observability:**
+
+- Logging implementation
+- Error tracking (Sentry/Datadog)
+- Health check endpoints
+- Alerting systems
+
+**C) Fault Tolerance:**
+
+- Database failover
+- Service redundancy
+- Backup strategies
+- Disaster recovery plan
+
+**D) Uptime & Availability:**
+
+- SLA targets
+- Historical uptime
+- Incident response
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "reliability",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Error Handling",
+      "status": "PASS",
+      "description": "Comprehensive error handling with circuit breakers",
+      "evidence": ["Circuit breaker pattern in src/services/", "Retry logic implemented"],
+      "recommendations": []
+    },
+    {
+      "category": "Monitoring",
+      "status": "CONCERN",
+      "description": "No APM (Application Performance Monitoring) tool",
+      "evidence": ["Logging present but no distributed tracing"],
+      "recommendations": ["Implement APM (Datadog/New Relic)", "Add distributed tracing"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS"
+  },
+  "priority_actions": ["Implement APM for better observability"],
+  "summary": "Reliability is good with minor monitoring gaps"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subagent completes when JSON output written to temp file.

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04d-subagent-scalability.md

@@ -0,0 +1,88 @@
+---
+name: 'step-04d-subagent-scalability'
+description: 'Subagent: Scalability NFR assessment'
+subagent: true
+outputFile: '/tmp/tea-nfr-scalability-{{timestamp}}.json'
+---
+
+# Subagent 4D: Scalability NFR Assessment
+
+## SUBAGENT CONTEXT
+
+This is an **isolated subagent** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess SCALABILITY NFR domain only.
+
+---
+
+## SUBAGENT TASK
+
+### 1. Scalability Assessment Categories
+
+**A) Horizontal Scaling:**
+
+- Stateless architecture
+- Load balancer configuration
+- Container orchestration (K8s)
+- Auto-scaling policies
+
+**B) Vertical Scaling:**
+
+- Resource allocation
+- Database size limits
+- Memory management
+- CPU optimization
+
+**C) Data Scaling:**
+
+- Database partitioning/sharding
+- Read replicas
+- Caching layers
+- Data archival strategy
+
+**D) Traffic Handling:**
+
+- CDN for static assets
+- Rate limiting
+- Queue systems for async work
+- WebSocket scaling
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "scalability",
+  "risk_level": "MEDIUM",
+  "findings": [
+    {
+      "category": "Horizontal Scaling",
+      "status": "PASS",
+      "description": "Stateless architecture with container orchestration",
+      "evidence": ["Docker + Kubernetes setup", "Auto-scaling configured"],
+      "recommendations": []
+    },
+    {
+      "category": "Data Scaling",
+      "status": "CONCERN",
+      "description": "No database sharding strategy for large data growth",
+      "evidence": ["Single database instance", "No partitioning"],
+      "recommendations": ["Plan database sharding strategy", "Implement read replicas", "Consider database clustering"]
+    }
+  ],
+  "compliance": {
+    "1M_users": "PASS",
+    "10M_users": "CONCERN",
+    "100M_users": "FAIL"
+  },
+  "priority_actions": ["Design database sharding strategy for future growth", "Implement read replicas for read-heavy workloads"],
+  "summary": "Scalability is good up to 1M users, concerns for 10M+ users"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subagent completes when JSON output written to temp file.